adaaf38e5ca03aa12b1c895e5cb76eb7ef9ff2915bec9996fbf83c3ce382a612

Analysis

Target

DXF/H244999.0E01_REVA.dxf
Size

5.1MB
MD5

5bfc084d6979b766cba1b7225aabb654
SHA1

ed0135443f529fd17061a4cae14e90b9651b98ac
SHA256

bdd618eeec2ad13c84d73f4926e8515a8a49105df2fb83cc91ea39bab01ff406
SHA512

560b4d9097f8708dafca79e970858b5a637c689bd3285ed5eb15419d3b397cc06a8846af808fbe99c495270fb2ac150f364e90dacc3937dbdd4a7a82640cf492

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4484 OpenWith.exe

pid	process
4484	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DXF\H244999.0E01_REVA.dxf
1⤵
- Modifies registry class
PID:4796

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact